ISO/IEC 7816-13:2007

Overview

ISO/IEC 7816-13:2007 defines the standardized commands for application management in a multi-application integrated circuit card (ICC). It specifies the command set that covers the entire life cycle of on-card applications - from creation and loading through activation, deactivation and removal - and applies to operations performed both before and after issuance to the cardholder. The standard defines interfaces and data object formats for interoperability but does not specify internal card implementation or external system behavior.

Key topics and technical requirements

• Life cycle model and states: Application states are defined (Non Existent, Creation, Initialisation, Operational Activated, Operational Deactivated, Application Removed) and transitions are driven by management commands. Life cycle coding follows the LCS byte conventions in ISO/IEC 7816-4.
• Core commands: The standard specifies the main commands used for application management, notably APPLICATION MANAGEMENT REQUEST, LOAD APPLICATION and REMOVE APPLICATION (with parameterized P1/P2 values to control transitions).
• Card manager requirements: A unique, selectable card manager application must be present (default AID: E8 28 BD 08 0D). All applications must be selectable via the SELECT command using their AID as the DF name.
• Memory resource assignment: A memory resource assignment template (tag 7F65) and related data objects (e.g., tags 80, 81, 82, 83) describe reserved and quota memory for persistent and volatile storage to allow interoperable resource allocation.
• Interoperability & encoding: ASN.1/BER encoding rules per ISO/IEC 8825-1 are referenced for encoding data objects. Normative dependencies include ISO/IEC 7816-4 and ISO/IEC 7816-9.
• Scope limitation: The standard defines commands and data structures but explicitly excludes internal implementation details of the card platform or external systems.

Applications and who uses it

ISO/IEC 7816-13 is used where multiple independent applications must coexist on a single smart card. Typical stakeholders:

• Card manufacturers and platform developers – implement card manager interfaces and resource control.
• Application providers and integrators – prepare installable application packages and memory assignment templates.
• Card issuers and service operators – manage application lifecycle pre- and post-issuance (e.g., loading, activation, removal).
• System architects and security engineers – ensure lifecycle and resource management complies with interoperability and security requirements.

Practical use cases include multi-application ID cards, payment and e‑wallet cards, transit and loyalty cards, and any ICC where distinct providers deploy applications to a shared card platform.

Related standards

• ISO/IEC 7816-4 - Organization, security and commands for interchange (LCS byte coding, AID/SELECT behavior)
• ISO/IEC 7816-9 - Commands for card management
• ISO/IEC 8825-1 - ASN.1 encoding rules (BER/CER/DER)

Keywords: ISO/IEC 7816-13, integrated circuit cards, application management, multi-application environment, card manager, AID, LOAD APPLICATION, REMOVE APPLICATION, memory resource assignment.